Is this a virus?

[HazardCirno]

Tried to download it for my Windows 7 on my second hard drive, but my Operating System Windows 10 detected a virus, What's with this solution?

[Special-Niewbie]

Tried to download it for my Windows 7 on my second hard drive, but my Operating System Windows 10 detected a virus, What's with this solution?

I am a developer and I don't know if the developer will answer you but, here it's from my understanding:
To achieve its compatibility goals, VxKex employs low-level system manipulation techniques, which are inherently powerful and, as a result, can be perceived as shady by security tools.

The developer uses DLL (Dynamic Link Library) Injection, a key aspect of how VxKex works is loading a DLL into every program for which VxKex is enabled. This is a technique where a dynamic library is forced into the address space of a running process. This action is necessary to allow VxKex to intercede in the application's communications with the operating system.

It also uses API (Application Programming Interface) Hooking, once its DLL is injected, VxKex uses API hooking. This involves "intercepting API function calls, messages, or events passed between software components". VxKex "hooks a handful of NTAPIs and also makes a number of direct system calls". The goal is to redirect calls from missing or obsolete Windows 7 APIs to its own VxKex DLLs, which contain updated implementations. This redirection is the heart of its compatibility functionality, allowing applications to find the functions they expect, even if they are not natively present in Windows 7.

It also uses the IFEO (Image File Execution Options) Registry Key. The mechanism for loading the VxKex DLL into target processes is implemented through the IFEO registry key. Specifically, the "VerifierDlls" value is set to point to a VxKex DLL. This is a legitimate Windows debugging mechanism that VxKex leverages to ensure that its DLLs are loaded at process startup. The use of IFEO is an example of how VxKex deeply integrates into the operating system to provide its functionality.

A key point of reassurance provided by the developer/s is that "VxKex does not modify any system files". 1 Its impact is localized to enabled applications and it is easily uninstallable. This feature is important to distinguish VxKex from malware that often aims to modify system files for persistence or to compromise the integrity of the system.

So to answer you NO, the very nature of the legitimate compatibility work of VxKex, requires these deep interactions at the system level. It is not a virus, but it uses deep techniques for the system that antivirus can give false positives. The developer did a good job. Then if one day it will become one I do not know, but for now the project is open and it is this. Then also the developers (if they want) will respond, but they have given a valid solution and I hope they continue...

@i486 , @VladiStep am I right?!

[acyc070]

Tried to download it for my Windows 7 on my second hard drive, but my Operating System Windows 10 detected a virus, What's with this solution?

I am a developer and I don't know if the developer will answer you but, here it's from my understanding: To achieve its compatibility goals, VxKex employs low-level system manipulation techniques, which are inherently powerful and, as a result, can be perceived as shady by security tools.

The developer uses DLL (Dynamic Link Library) Injection, a key aspect of how VxKex works is loading a DLL into every program for which VxKex is enabled. This is a technique where a dynamic library is forced into the address space of a running process. This action is necessary to allow VxKex to intercede in the application's communications with the operating system.

It also uses API (Application Programming Interface) Hooking, once its DLL is injected, VxKex uses API hooking. This involves "intercepting API function calls, messages, or events passed between software components". VxKex "hooks a handful of NTAPIs and also makes a number of direct system calls". The goal is to redirect calls from missing or obsolete Windows 7 APIs to its own VxKex DLLs, which contain updated implementations. This redirection is the heart of its compatibility functionality, allowing applications to find the functions they expect, even if they are not natively present in Windows 7.

It also uses the IFEO (Image File Execution Options) Registry Key. The mechanism for loading the VxKex DLL into target processes is implemented through the IFEO registry key. Specifically, the "VerifierDlls" value is set to point to a VxKex DLL. This is a legitimate Windows debugging mechanism that VxKex leverages to ensure that its DLLs are loaded at process startup. The use of IFEO is an example of how VxKex deeply integrates into the operating system to provide its functionality.

A key point of reassurance provided by the developer/s is that "VxKex does not modify any system files". 1 Its impact is localized to enabled applications and it is easily uninstallable. This feature is important to distinguish VxKex from malware that often aims to modify system files for persistence or to compromise the integrity of the system.

So to answer you NO, the very nature of the legitimate compatibility work of VxKex, requires these deep interactions at the system level. It is not a virus, but it uses deep techniques for the system that antivirus can give false positives. The developer did a good job. Then if one day it will become one I do not know, but for now the project is open and it is this. Then also the developers (if they want) will respond, but they have given a valid solution and I hope they continue...

@i486 , @VladiStep am I right?!

I agree.

[CommonLoon102]

A virus is a virus because it can spread automatically on its own. VxKex is not copying itself, so it is not a virus.

[vikingo12]

ur first day on pc?

[Giddur]

It's detected as a virus in more than 40+ AVs if you scan it with VirusTotal ıncluding AVs like Bitdefender and Kaspersky.Why the passive aggressive response?

[CommonLoon102]

It is detected as a virus because it is using a Windows function what is only being used by VxKex and viruses.

[Neustradamus]

Linked to:

• Virustotal tells me it is very, very, very bad YuZhouRen86/VxKex-NEXT#7
• Chrome visits the installer as infected, Kaspersky immediately deletes it, what should I do? YuZhouRen86/VxKex-NEXT#101
• Resported as virus by Virustotal (false positive I asume) YuZhouRen86/VxKex-NEXT#106
• A lot of engines at VirusTotal flaggs the installer as a virus YuZhouRen86/VxKex-NEXT#164
• The False Positives?Is Vxkex/Vxkex(16stars) a legit fork or imposter? YuZhouRen86/VxKex-NEXT#177
• 1.1.3.1584 reported as virus by Kaspersky antivirus YuZhouRen86/VxKex-NEXT#182

Linked to VxKex:

• Latest version not so clean. #26
• Concerning behaviour. #41
• Still not so clean. #55
• Cursed repo - why are we still unsure? #65
• Firefox & Avast mark VxKex as malware #85
• 50 / 72 detections on VT ? #107
• When using Vekex, I encountered a security software virus issue, and I tried to investigate what caused it #117
• Is this a virus? #130
• Windows detects a virus. #166
• every version gets deleted by windows defender #187
• Firefox Download warning #191
• Please help! I can't download this no matter what browser I use. What am I doing wrong? #197
• The False Positives?Is Vxkex/Vxkex(16stars) a legit fork or imposter? #200

[dangojroddor411-cmyk]

So I downloaded it and guess what it did. Partially copied my pictures folder, stopped and closed my Windows Defender, also preventing it from running again. I had Malwarebytes running which detected malware, and Quarantined it. Hence the partial.

[acyc070]

Doubt it's VxKex, what's your OS, version?

[CommonLoon102]

Copied to where?

[dangojroddor411-cmyk]

Copied into a new folder they made just called downloads. I'm running Windows 7. It was KexSetup-Release-ci-build.exe and the other was the source / Source code (tar.gz) in my c:/ drive.
VxKex_Source_Code_1_2_1_2229.7z seems to be clean, but the above ones had other shit in them perhaps.
Malwarebytes has these Quarantined as 1x Malware, and 2x Riskware.

[CommonLoon102]

What did you do with the source code? Why have you downloaded it? A .tar.gz or .7z file cannot do anything to your computer if you just download them (and don't even open them) and they are sitting in the download folder.

[CommonLoon102]

@i486 The Win7SDK used to build VxKex also has malware (trojan):
https://www.virustotal.com/gui/file/8d90703130c4bc735fa215ee14cddf868e27c156b72065c434ec747d5f120d44?nocache=1